Encryption transforms card data into ciphertext using a mathematical key — the original data is still there, just scrambled. Tokenization replaces card data with a random token that has no mathematical relationship to the original; the real card lives in a secured vault under the gateway's control, and the merchant sees only an opaque reference. They solve different problems: encryption protects data in motion; tokenization protects data at rest by making the merchant's copy worthless if stolen. Most production gateways use both, in different parts of the flow.
How each technique works
Encryption
The card number is run through an algorithm (AES-256, TLS, P2PE) with a key. The output is ciphertext that can be decrypted back to the original card number if you have the key. Reversible by design.
Tokenization
The card number is sent to a vault. The vault stores it and returns a random token (e.g. tok_5fK9xQ2). The token has no card-number significance outside the vault — it's a lookup key. Not reversible without vault access.
When each one is right
- Data in transit — encryption. TLS protects the HTTPS connection from your checkout to the gateway; P2PE protects from the card-present terminal to the secure endpoint. Encryption is the only practical option here because the receiver needs the actual card number to process it.
- Data at rest, stored for repeat use — tokenization. Card-on-file billing, recurring subscriptions, and saved-card UX in checkouts use tokens. The merchant stores tokens; the real card lives in the vault.
- Card-present terminals — both. P2PE encryption from the reader to the secure endpoint, then tokenization for any card you want to remember (e.g. EMV terminal vaulting for tap-to-pay).
- Legacy databases of stored cards — migrate to tokens. Encrypted card storage is still PCI-scoped and risky if keys leak.
People also ask about tokenization vs encryption
Which is more secure for stored cards?
Tokenization. A stolen token reveals nothing about the original card — there is no decryption key that recovers it, because the relationship is a vault lookup, not a math operation. Encrypted stored cards can be decrypted if the key is also stolen, which happens in many real breaches (the Target breach, for example, involved both encrypted card storage and stolen keys).
Do gateways use both?
Yes — they layer. A typical flow: TLS encrypts the connection from your site to the gateway; the gateway uses tokenization to store the card in its vault; subsequent transactions reference the token rather than the card. Card-present terminals add P2PE encryption from the reader to the secure endpoint. Encryption and tokenization solve different problems and stack cleanly.
Why does tokenization shrink PCI scope?
PCI DSS applies to systems that store, process, or transmit cardholder data. A token is not cardholder data — it has no card-number significance outside the vault. Merchant systems that handle only tokens fall outside PCI scope and qualify for the much lighter SAQ A or A-EP. Encrypted card data is still cardholder data; encryption alone doesn't de-scope.
Concrete example: subscription billing
A SaaS company charges customers monthly. The naive approach: store the card number, encrypted with AES-256, in your database, decrypt monthly to charge. PCI implication: SAQ D, the heaviest tier, full PCI scope on your database.
The tokenized approach: on signup, send the card to the gateway's vault (over TLS), receive a token, store the token. Each month, send the token + amount to the gateway, which looks up the real card in the vault and processes. Your database has no card numbers at all — only opaque tokens. PCI scope drops to SAQ A-EP, your breach exposure for cards is zero, and the database becomes much less interesting to attackers.
If you ever need to store a card for repeat use, tokenize it. If card data is moving across a network, encrypt it. Don't try to substitute one for the other — they protect against different threats.
FAQ
Encryption vs tokenization?
Encryption: card scrambled with a key, reversible with the key. Tokenization: card replaced by random token, real card in a separate vault, no key to "decrypt" it.
More secure for storage?
Tokenization. Stolen tokens reveal no card data; stolen encrypted cards can be decrypted if keys leak too.
Use both?
Yes — TLS for transit, P2PE for terminals, tokenization for storage. They layer.
PCI impact?
Tokenization shrinks PCI scope significantly; encryption alone doesn't (data is still PCI-scoped while encrypted).
NMI?
NMI uses both — TLS in transit, Customer Vault for tokenized storage. See the gateway.